An Introduction to a Tale of Obsession, Side Quests, and Open Ledgers

I don’t remember for sure how it happened, but I think I first heard of 0xa57b (the address that at some point I would name Belisarius) from a fairly innocent Crypto Twitter interaction in which some members of the ecosystem made comments about offering prayers and sacrifices to 0xa57b whenever they made a transaction. As an enjoyer of Cthulhu-like figures in all aspects of life, I likely just filed the tidbit away mentally at the time. As time would go by, though, I would slowly discover more details. Unlike many little hobbies of mine, this one would accumulate slowly. I embarked on one side quest after another until I realized that it wasn’t just a series of tangents, but a campaign of its own.

Belisarius/0xa57b is baptized as “MEV Bot” on Etherscan, one of many addresses to share the moniker. MEV has long been referred to as a dark forest, or in more simple terms, a field in which clearly discerning the participants is difficult. (That isn’t the full definition of a dark forest as it’s usually used, I know, but is sufficient for right here and right now in my humble opinion.) However, the nature of blockchains is such that at least some of the information should always be there, right in front of our eyes, immutably inscribed on the public ledger for eternity. Even if it may be difficult to predict where the spirits of MEV may strike next, at the very least it should be possible to see post facto where they already did strike, and in the presence of sufficient data, reconstruct an idea of strategy. Have I mentioned that Belisarius has, as of this writing, already transacted more than 3.4 million times?

(Another interesting tidbit about Belisarius is that it’s old, at least by my standards. It’s called “MEV Bot” on Etherscan, but as far as I can tell, it actually predates the term MEV. You can check on Etherscan, it was deployed in block 7,445,835 on March 26, 2019, and at least the first reference I’m aware of to MEV was Karl Floersch at EthCC in 2020 (unless I totally made that up, I went looking for the talk but didn’t find it), a bit more than a year later.)

Those in the field seem to agree that most participants try to obfuscate themselves to some degree. The reasoning seems simple: if you have a winning value-extraction strategy, you stand to gain the most the fewer people that know about that strategy. There is a finite amount of money that the strategy will work for, and the more people participating, the thinner that number is stretched. As a result it can be hard to find information about how to enter the field, and I have even seen it said that sometimes deliberate misinformation is spread. But the chain doesn’t usually lie, anon.

I started asking myself what would be if we could cast light on these dark environs.

One thing that seems consistent is that successfully partaking of the spoils of war requires persistence and determination. I will likely never fulfill these criteria. If I ever played games, I was probably the kind of person who spent their time constructing Final Fantasy parties of the members I thought the main character would probably take with, a long trail of unfinished attempts behind me. (Maybe. I can’t confirm.) I am a dreamer and a tinkerer. But what if that dream could conjure the preimage of the hidden? Could we level the playing field even more?

Perhaps I shall become Light, revealer of worlds.

I would be remiss if I omitted the amount of help I’ve gotten along the way. I switch between I/me and we/us frequently since a lot of the time someone was helping me out along the way. Not only is Ethereum an open ledger, but also a very open community, and my experience has always been that there are a lot of people out there who are happy to help. I often do not refer to those who have helped by name. An assumption I’m making is that not everyone wants their name publicized all the time. If you see something here that you helped with and are interested in attribution, please let me know and I’ll rectify it.

I had not realized at the inception of this journey how many different skill sets would be needed for it. In addition to the fruits of the labor, which at this point are largely nonexistent anyway, the actual labor itself may be of use to those looking at scenarios where the same skills are needed. We started with reverse engineering raw bytecode, moved on to bytecode decoding, engaged in historical analysis, dabbled in forensics, and that’s where we are as of now, though the future is quite open to more too.

I make no claims to be an expert of any of these methods, and in fact, will try to include where I stumbled and blundered along the way. This is not meant to be a textbook of successes, rather a cypherpunk noir tale of late nights in rooms dimly lit by the glow of monitors, of stumbling through raw hexadecimal streams, and what dark detective tale is not enriched by seeing the blunders along the way?

In that sense, these writings also serve as a signal, a call to anyone who sees more and further than I, to offer their wisdom to the story, to piece the puzzle together in ways I could not. Please do reach out and illuminate that which I did not.

This post serves as an introduction to our story, and a portal to the chapters of it. As such, it is my hope that it is updated over time, since this caper is long from solved. My suspicion now is that the chapters will not need to be read sequentially, though it might add some context. Different chapters are likely to emphasize different skills or tools, so from a technical perspective, they are likely to have standalone value. I certainly have not written myself into a wall yet, and in fact have not even written all the chapters described here. As such, I hope that this list will be added to over time, and that items that appear here as ideas, and yet-to-be-published writings will be made into live links.

Already written:

Chapter 1 deals with the initial parts of trying to decompile Belisarius, focusing on the functions with selectors already in 4byte at the time of the writing.

https://mirror.xyz/wschwab.eth/BNalhR2Z3jsyB24CUAiMKGLbwz411j0QYU-aIkkzaI0

Chapter 2 continues the decompilation, focusing on the two functions with selectors not in the public databases (0x78e111f6 and 0xa90e8731). In addition to looking at the decompilation more closely, we also start looking at raw calldata to understand these functions better.

It's likely worth pointing out here already that decompiling Belisarius is really not all that relevant to MEV or getting any kind of understanding of Belisarius's operations. At the same time, it is a nice side quest on its own, at least in my opinion, and I figure it might be a useful resource to have an amateur at the craft of contract reverse engineering detail what diving into such an endeavor was like.

https://mirror.xyz/wschwab.eth/cB8O2y3BqKublvhEhgsg7iX1B-Aee_cGCBZ5K6NWkFA

Currently being written:

Chapter 3 is a bit of a break from work directly on Belisarius, and instead details the setup we set up as we started on full-fledged analytics. This includes setting up a server, provisioning it with clients and Trueblocks, discovering how to back up datasets, and trying to build a pipeline.

Some ideas for future chapters:

A more detailed analysis. We begin by looking at Belisarius’s operators, and how some of the inquiries in Chapter 2 lead to discovering a whole horde of MEV bot contracts.

Continuing with analysis, shifting focus from the operators to the strategy contracts that Belisarius makes use of. I suspect that we'll need to decompile some of the more popular strategy contracts, though I don't know if we'll spend as much time on it this time around.

I wouldn't take the plans too seriously, though. If there's one thing that's likely, it's that new information and discoveries lead to new directions. New ideas with the old happen over time too. I'm already considering putting in interludes that are more story-like. I've got one so far, and I hope to unearth more stories from the data as time goes by.

There are various pieces of data we’ve put together over the months we’ve been working on this. We would like for these to be open to the public, but also are aware that there is some volatility in the data due to my own amateur nature. As such, I’ll link to what we have now, with the caveat that some of it is likely to change. As time goes by, I hope to have more confidence and to have things take more shape, and perhaps the contents and links in this section will change.

• A loose recreation of Belisarius’s contract - coming to these conclusions is the topic of the first two chapters, and I almost feel like it’s spoilers to see it before seeing those, but I should probably just get over myself and link it directly.

• Kaggle dataset - I hope we’ll explain this in more detail in Chapter 3 and beyond, but the quick explanation would be that this is a dataset of all txs, logs/events, and traces from Belisarius, updated weekly. There are also some helper datasets there, like a list of any EOA that’s interacted with Belisarius, sorted by how many times they interacted. The set is generated using Trueblocks, and I hope to cover in detail how we're using Trueblocks to get this data.

One of the joys of publishing on Mirror is the built-in ability to tokenize the works. This gave me the idea of asking some artists if they would be interested in making artwork for the articles, since I figure that owning an NFT of a blog post with cool artwork is much cooler than owning an NFT of a blog post without. The goal is not really to rake in mad stacks of cash, and as such the plan is to keep the NFTs as plentiful as Mirror allows, and cheap. On the other hand, I'm only a part of the equation, so whatever supply/price there is for any given chapter will be a discussion between us.

This article's art was created by Mojibake, who created it based on the idea of a dark spirit stalking the chain. The image is both cropped and compressed to work with Mirror, if you’d like to view the original, see here. (Thanks to zkDoof for the help with uploading it.)

An Introduction to a Tale of Obsession, Side Quests, and Open Ledgers

I don’t remember for sure how it happened, but I think I first heard of 0xa57b (the address that at some point I would name Belisarius) from a fairly innocent Crypto Twitter interaction in which some members of the ecosystem made comments about offering prayers and sacrifices to 0xa57b whenever they made a transaction. As an enjoyer of Cthulhu-like figures in all aspects of life, I likely just filed the tidbit away mentally at the time. As time would go by, though, I would slowly discover more details. Unlike many little hobbies of mine, this one would accumulate slowly. I embarked on one side quest after another until I realized that it wasn’t just a series of tangents, but a campaign of its own.

Belisarius/0xa57b is baptized as “MEV Bot” on Etherscan, one of many addresses to share the moniker. MEV has long been referred to as a dark forest, or in more simple terms, a field in which clearly discerning the participants is difficult. (That isn’t the full definition of a dark forest as it’s usually used, I know, but is sufficient for right here and right now in my humble opinion.) However, the nature of blockchains is such that at least some of the information should always be there, right in front of our eyes, immutably inscribed on the public ledger for eternity. Even if it may be difficult to predict where the spirits of MEV may strike next, at the very least it should be possible to see post facto where they already did strike, and in the presence of sufficient data, reconstruct an idea of strategy. Have I mentioned that Belisarius has, as of this writing, already transacted more than 3.4 million times?

(Another interesting tidbit about Belisarius is that it’s old, at least by my standards. It’s called “MEV Bot” on Etherscan, but as far as I can tell, it actually predates the term MEV. You can check on Etherscan, it was deployed in block 7,445,835 on March 26, 2019, and at least the first reference I’m aware of to MEV was Karl Floersch at EthCC in 2020 (unless I totally made that up, I went looking for the talk but didn’t find it), a bit more than a year later.)

Those in the field seem to agree that most participants try to obfuscate themselves to some degree. The reasoning seems simple: if you have a winning value-extraction strategy, you stand to gain the most the fewer people that know about that strategy. There is a finite amount of money that the strategy will work for, and the more people participating, the thinner that number is stretched. As a result it can be hard to find information about how to enter the field, and I have even seen it said that sometimes deliberate misinformation is spread. But the chain doesn’t usually lie, anon.

I started asking myself what would be if we could cast light on these dark environs.

One thing that seems consistent is that successfully partaking of the spoils of war requires persistence and determination. I will likely never fulfill these criteria. If I ever played games, I was probably the kind of person who spent their time constructing Final Fantasy parties of the members I thought the main character would probably take with, a long trail of unfinished attempts behind me. (Maybe. I can’t confirm.) I am a dreamer and a tinkerer. But what if that dream could conjure the preimage of the hidden? Could we level the playing field even more?

Perhaps I shall become Light, revealer of worlds.

I would be remiss if I omitted the amount of help I’ve gotten along the way. I switch between I/me and we/us frequently since a lot of the time someone was helping me out along the way. Not only is Ethereum an open ledger, but also a very open community, and my experience has always been that there are a lot of people out there who are happy to help. I often do not refer to those who have helped by name. An assumption I’m making is that not everyone wants their name publicized all the time. If you see something here that you helped with and are interested in attribution, please let me know and I’ll rectify it.

I had not realized at the inception of this journey how many different skill sets would be needed for it. In addition to the fruits of the labor, which at this point are largely nonexistent anyway, the actual labor itself may be of use to those looking at scenarios where the same skills are needed. We started with reverse engineering raw bytecode, moved on to bytecode decoding, engaged in historical analysis, dabbled in forensics, and that’s where we are as of now, though the future is quite open to more too.

I make no claims to be an expert of any of these methods, and in fact, will try to include where I stumbled and blundered along the way. This is not meant to be a textbook of successes, rather a cypherpunk noir tale of late nights in rooms dimly lit by the glow of monitors, of stumbling through raw hexadecimal streams, and what dark detective tale is not enriched by seeing the blunders along the way?

In that sense, these writings also serve as a signal, a call to anyone who sees more and further than I, to offer their wisdom to the story, to piece the puzzle together in ways I could not. Please do reach out and illuminate that which I did not.

This post serves as an introduction to our story, and a portal to the chapters of it. As such, it is my hope that it is updated over time, since this caper is long from solved. My suspicion now is that the chapters will not need to be read sequentially, though it might add some context. Different chapters are likely to emphasize different skills or tools, so from a technical perspective, they are likely to have standalone value. I certainly have not written myself into a wall yet, and in fact have not even written all the chapters described here. As such, I hope that this list will be added to over time, and that items that appear here as ideas, and yet-to-be-published writings will be made into live links.

Already written:

Chapter 1 deals with the initial parts of trying to decompile Belisarius, focusing on the functions with selectors already in 4byte at the time of the writing.

https://mirror.xyz/wschwab.eth/BNalhR2Z3jsyB24CUAiMKGLbwz411j0QYU-aIkkzaI0

Chapter 2 continues the decompilation, focusing on the two functions with selectors not in the public databases (0x78e111f6 and 0xa90e8731). In addition to looking at the decompilation more closely, we also start looking at raw calldata to understand these functions better.

It's likely worth pointing out here already that decompiling Belisarius is really not all that relevant to MEV or getting any kind of understanding of Belisarius's operations. At the same time, it is a nice side quest on its own, at least in my opinion, and I figure it might be a useful resource to have an amateur at the craft of contract reverse engineering detail what diving into such an endeavor was like.

https://mirror.xyz/wschwab.eth/cB8O2y3BqKublvhEhgsg7iX1B-Aee_cGCBZ5K6NWkFA

Currently being written:

Chapter 3 is a bit of a break from work directly on Belisarius, and instead details the setup we set up as we started on full-fledged analytics. This includes setting up a server, provisioning it with clients and Trueblocks, discovering how to back up datasets, and trying to build a pipeline.

Some ideas for future chapters:

A more detailed analysis. We begin by looking at Belisarius’s operators, and how some of the inquiries in Chapter 2 lead to discovering a whole horde of MEV bot contracts.

Continuing with analysis, shifting focus from the operators to the strategy contracts that Belisarius makes use of. I suspect that we'll need to decompile some of the more popular strategy contracts, though I don't know if we'll spend as much time on it this time around.

I wouldn't take the plans too seriously, though. If there's one thing that's likely, it's that new information and discoveries lead to new directions. New ideas with the old happen over time too. I'm already considering putting in interludes that are more story-like. I've got one so far, and I hope to unearth more stories from the data as time goes by.

There are various pieces of data we’ve put together over the months we’ve been working on this. We would like for these to be open to the public, but also are aware that there is some volatility in the data due to my own amateur nature. As such, I’ll link to what we have now, with the caveat that some of it is likely to change. As time goes by, I hope to have more confidence and to have things take more shape, and perhaps the contents and links in this section will change.

• A loose recreation of Belisarius’s contract - coming to these conclusions is the topic of the first two chapters, and I almost feel like it’s spoilers to see it before seeing those, but I should probably just get over myself and link it directly.

• Kaggle dataset - I hope we’ll explain this in more detail in Chapter 3 and beyond, but the quick explanation would be that this is a dataset of all txs, logs/events, and traces from Belisarius, updated weekly. There are also some helper datasets there, like a list of any EOA that’s interacted with Belisarius, sorted by how many times they interacted. The set is generated using Trueblocks, and I hope to cover in detail how we're using Trueblocks to get this data.

One of the joys of publishing on Mirror is the built-in ability to tokenize the works. This gave me the idea of asking some artists if they would be interested in making artwork for the articles, since I figure that owning an NFT of a blog post with cool artwork is much cooler than owning an NFT of a blog post without. The goal is not really to rake in mad stacks of cash, and as such the plan is to keep the NFTs as plentiful as Mirror allows, and cheap. On the other hand, I'm only a part of the equation, so whatever supply/price there is for any given chapter will be a discussion between us.

This article's art was created by Mojibake, who created it based on the idea of a dark spirit stalking the chain. The image is both cropped and compressed to work with Mirror, if you’d like to view the original, see here. (Thanks to zkDoof for the help with uploading it.)